Post on 22-May-2020
transcript
Panel Discussion: Cybersecurity
Daniel J. Larkin (Moderator)
Director of Strategic Operations
NCFTA
Greg Henderson
Government Practice Principal
Fraud & Financial Crimes Global Practice
SAS
Peter J. Ahearn Jr.
Special Agent
FBI
Gregory K. Baker
Director, NC Alcohol Law Enforcement
Special Agent (retired)
FBI
John P. O’Neill Jr.
SVP, Fraud Investigations Group
Bank of America
John Riggi
Assistant Special Agent In Charge
FBI
•The Changing Landscape (updated definitions)
•Expanding roles & number of key stakeholders•Responsible players? Carrots or Sticks to apply?
•Regulatory re-tooling & re-interpreting•Timely responsible sharing “Resources”
•Pit – Falls to effective “Best Practices”•Institutional Silos? - what causes them?
•What frustrates you the most ??
Bringing together a growing pool of cross-sector Subject Matter Experts, real time to rapidly identify, mitigate and
ultimately neutralize global cyber based threats.
•Networks
•Employees
•Customers
•Suppliers – vendors –sub-contractors
• Proprietary information
Govt/Law EnforIndustry/NCFTAFBI = 16+
Other Gov = 1-4
DHS = 2-4
DoD = 1-2
DEA = 1
International = 2-6
Specific Industry = 10 - 15
Funded industry = 10-20
Analyst/Trainee = 8-10
NCFTA Admin & IT = 15
Total @ 45-50+
Neutral “Meet in the Middle” (Non-Profit) Space
Intel Reports
Analysis
Alerts -PSAs
Case Development
Case Referrals
Proactive Support
National Cyber Forensics & Training Alliance
Meeting with Law Enforcement
National Cyber Forensics & Training Alliance
Focus Group Follow-up
Citadel/Spam *
Victim User
Compromised Credentials
Major Payment Gateways
Processors
HTMLInjection
PopUp
Customize/Bank
Victim Bank ACH $
Mules
Mule Bank
Account
Mule Bank
Account
Mule Bank
Account
MoneygramWestern Union
$$
Subject AccountsBad Guys
Career BuilderMonster
Bad GuysFairlove, Inc.
*Malware Delivery*Tragedy in Media – Gotcha!*Flash Updates, other common software*Princess Dianna – again?
Recruitment
Zues BotJabber
SMS -Token
1
2
3
4
5
6
7
8
Malware/Botnets Financial Institutions
Money Mule Network Subjects
“This is the FIRST working virus free SMS
Bomber that I have found to be successful.”
“Ok guys…its been a while since I have posted an
update for my program SMS Bomber
International…”
“I made us this pretty decent SMS spammer
(also works with regular emails).”
Pop3scan
SMTP Relays
Compromised
POP Accounts
Plx_ssh2.c
ssh brute force
Warez?
Load Modified Apache
Load IVM Answering Attendant
Load Fast Email Extractor
Fonosip
Inphonex
Callfire
Call-em-all
Leaddiamond
Ifbyphone
Automs
Marketingburst
Coatelecenter
Junctionnetworks
Voiceblast
vontoo
3rd Party Calling Services
WWW
Compromised Asterisk
Systems
Area Code
Email List
Bank
Credit Union
Card Info
Victims call in to get Voice Response Unit
IVM Answering Attendant
Mules cash out in:
Romania
Spain
San Diego
Chicago
NYC
LAInfrastructure
Bank – CU
Customers
(et al)
National Cyber Forensics & Training Alliance
1 FRAUD CASE, 6 INDUSTRIES
EMAIL PROVIDERS
BROKERAGE FIRMS
BANKS DATINGWEBSITES
INTERNATIONAL WIRES
TELCO
National Cyber Forensics & Training Alliance
Recent significant threats - DirtJumper Botnet
• First version published in January 2011
• Authored by “sokol”
• Service sold in Russian underground forums
• Initially used to wage DDOS attacks against Russian gaming websites
• One command and control server hosted at 193.106.31.73
• Identified as serving ZeuS v3 (gameover)
• Variants of botnet subsequently sold in underground forums
• DirtJumper v5 reported as newest version of botnet
Date MD5 IP Address Probable Location Host
3/6/2012 056cfa0acec5979d9cfdbeabb34be029 193.106.31.73 --, --, Ukraine mulnei.com
2/14/2012 c7e865ac644b2feb402548ffbe5cc089 193.106.31.73 --, --, Ukraine jerkor.com
2/14/2012 f99c2b3e150cc2175d4507b421ad576c 193.106.31.73 --, --, Ukraine jerkor.com
2/13/2012 b4bc76d86eb95343de711eefb9e93af3 193.106.31.73 --, --, Ukraine jerkor.com
National Cyber Forensics & Training Alliance
DirtJumper Botnet Operator
Additional Definitions to Consider……..